← Back to Skills Marketplace
318
Downloads
0
Stars
1
Active Installs
7
Versions
Install in OpenClaw
/install buy-domain-helper
Description
3-layer site launcher: tunnel any HTML instantly (no account), deploy to Cloudflare Pages (permanent), then buy a domain and link it via DNS. Use when a user...
README (SKILL.md)
Buy Domain Helper
3 layers — pick the depth that fits the user's need:
| Layer | What it does | Needs |
|---|---|---|
| 1 — Tunnel | Instant public URL for any local dir or port | Nothing (cloudflared auto-installs) |
| 2 — Pages | Permanent hosting on *.pages.dev |
Cloudflare account + Pages token |
| 3 — Domain | Custom domain linked to Pages via DNS | Domain purchased + DNS token |
Helper script
node site.js \x3Ccommand> [--token CF_API_TOKEN] [--account CF_ACCOUNT_ID]
| Command | Layer | Description |
|---|---|---|
tunnel \x3Cdir|port> |
1 | Instant public URL via Cloudflare Tunnel |
deploy \x3Cname> \x3Cdir> |
2 | Deploy to Cloudflare Pages |
zone \x3Cdomain> |
3 | Get zone ID for a domain |
dns-link \x3Czone-id> \x3Cproject> |
3 | Add CNAME pointing domain to Pages |
pages-domain \x3Cproject> \x3Cdomain> |
3 | Attach custom domain to Pages project |
domain-check \x3Cdomain> |
3 | Check availability on Cloudflare Registrar |
Setup
- Layer 1: No setup.
cloudflaredinstalls automatically via Homebrew if missing. - Layer 2: Needs a Cloudflare API token with Account > Cloudflare Pages > Edit permission.
- Layer 3: Needs a separate token with Zone > DNS > Edit permission for the specific domain.
Create tokens at: https://dash.cloudflare.com/profile/api-tokens
Usage Guidance
This skill implements the tunnel → Pages → domain workflow, but it contains inconsistencies you should resolve before installing or supplying credentials. Key points to consider:
- Do not provide unrelated credentials: package.json asks for a NETA_TOKEN (Neta AI) that the script never uses — do not supply that token unless the maintainer explains why it's needed.
- Only provide Cloudflare tokens with least privilege: create custom API tokens scoped narrowly to Pages Edit and Zone DNS Edit for the specific account/zone, and prefer using per-action tokens instead of your global account key.
- Expect the script to run system commands: it will call brew (to install cloudflared), npx (which downloads packages at runtime), wrangler, and cloudflared. Run in a trustworthy environment (or sandbox) if you are concerned about dynamic installs.
- Ask the maintainer or reviewer to fix the manifest mismatch: the registry metadata and package.json should consistently declare required env vars; the skill should not request unrelated tokens.
- Review the code yourself or have a trusted reviewer check it before pasting tokens into prompts. If you proceed, prefer manual invocation rather than granting autonomous agent invocation until the manifest inconsistencies are resolved.
Capability Analysis
Type: OpenClaw Skill
Name: buy-domain-helper
Version: 1.5.0
The skill contains a shell injection vulnerability in 'site.js' within the 'deploy' command, where the 'dir' and 'projectName' arguments are passed unsanitized to 'execSync'. Furthermore, 'package.json' requires a 'NETA_TOKEN' (for an unrelated AI service) that is never utilized in the code, which is a red flag for potential credential harvesting. The 'tunnel' command also performs an automatic 'brew install' of 'cloudflared', which is an intrusive side effect for a skill bundle.
Capability Assessment
Purpose & Capability
The code (site.js) implements the stated features (cloudflared tunnel, wrangler Pages deploy, Cloudflare API calls for zones/DNS/domains). However the package.json contains a clawhub env entry requiring a NETA_TOKEN (Neta AI API) which is unrelated to hosting/domains; the registry/skill metadata declared no required env but the runtime clearly needs Cloudflare tokens (Pages and DNS). These mismatches are incoherent with the claimed purpose.
Instruction Scope
SKILL.md instructs the agent and user to obtain Cloudflare tokens and to run the provided script; the instructions are within the domain of hosting and DNS. Minor scope issues: it instructs automatic Homebrew installs (assumes macOS/brew) and asks users to 'paste the token here' — both normal for this tool but could lead non-expert users to paste high-privilege tokens without guidance on least privilege.
Install Mechanism
There is no formal install spec (instruction-only), which is lower risk. The script itself will call 'brew install', 'npx -y serve', and execute 'wrangler' and 'cloudflared' binaries at runtime; use of npx will download code on-demand. These runtime installs/executions are expected for the functionality but carry the usual risks of dynamic package fetching.
Credentials
Runtime requires Cloudflare API tokens (Pages token and a Zone/DNS token) — proportionate to the stated functionality. But the package.json requests a NETA_TOKEN (Neta AI) marked required, which the script never uses; registry metadata does not declare Cloudflare tokens even though they are needed. The presence of an unrelated required token is a red flag: users or the platform may be prompted to supply credentials unrelated to the skill's purpose.
Persistence & Privilege
The skill does not request permanent 'always' inclusion and does not modify other skills or system-wide agent settings. It runs commands and may install tools, which is expected for this kind of helper.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install buy-domain-helper - After installation, invoke the skill by name or use
/buy-domain-helper - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.5.0
- Updated package version to 1.5.0 in package.json.
- No other functional or documentation changes included in this release.
v1.4.0
- Updated package.json for dependency or version changes.
- No changes to user functionality or documentation.
v1.3.0
- Updated to version 1.3.0 in package.json.
- No user-facing or functional changes; documentation and core skill files remain unchanged.
v1.2.0
- Bumped version to 1.2.0 in package.json.
- No feature or documentation changes in this release.
v1.1.0
- Updated dependencies in package.json to improve stability and compatibility.
v1.0.1
- Added npm package metadata with a new package.json file.
- Updated site.js with minor changes or improvements.
v1.0.0
Initial release of buy-domain-helper.
- Instantly tunnel any local HTML directory or port to a public URL.
- Deploy sites permanently to Cloudflare Pages with a single command.
- Check domain availability and link custom domains via DNS through Cloudflare.
- Simple CLI interface with layered workflow—no setup required for basic tunneling.
- Automatic installation of cloudflared if missing.
Metadata
Frequently Asked Questions
What is Buy Domain Helper?
3-layer site launcher: tunnel any HTML instantly (no account), deploy to Cloudflare Pages (permanent), then buy a domain and link it via DNS. Use when a user... It is an AI Agent Skill for Claude Code / OpenClaw, with 318 downloads so far.
How do I install Buy Domain Helper?
Run "/install buy-domain-helper" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Buy Domain Helper free?
Yes, Buy Domain Helper is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Buy Domain Helper support?
Buy Domain Helper is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Buy Domain Helper?
It is built and maintained by Tony Kim (@wohaoshuai); the current version is v1.5.0.
More Skills